PCI DSS 4.0
Req 6: Secure Systems and Software

PCI DSS 4.0 6.2.1: 6.2.1 Secure development of bespoke and custom software

Software the entity builds as bespoke or custom code must be produced through a secure development process that: rests on industry standards or recognised good practice for secure development; conforms to PCI DSS itself (for instance, secure authentication and logging); and takes information security issues into account at every stage of the software development lifecycle. It applies to all entities that build software. Applicability: covers all software built by or for the entity for its own use, both bespoke and custom; third-party software is out of scope for this requirement. Objective under the customized approach: bespoke and custom software is built in line with PCI DSS and secure development practice across its whole lifecycle.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 69 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 5 controls

  • CIS-16.1 Establish and Maintain a Secure Application Development Process
  • CIS-16.10 Apply Secure Design Principles in Application Architectures
  • CIS-16.12 Implement Code-Level Security Checks
  • CIS-16.14 Conduct Threat Modeling
  • CIS-16.9 Train Developers in Application Security Concepts and Secure Coding

FedRAMP High · 5 controls

  • SA-11(1) Developer Testing and Evaluation | Static Code Analysis (SA-11(1))
  • SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses (SA-11(2))
  • SA-15 Development Process, Standards, and Tools (SA-15)
  • SA-3 System Development Life Cycle
  • SA-8 Security and Privacy Engineering Principles

FedRAMP Moderate · 5 controls

  • SA-11(1) Developer Testing and Evaluation | Static Code Analysis (SA-11(1))
  • SA-11(2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses (SA-11(2))
  • SA-15 Development Process, Standards, and Tools (SA-15)
  • SA-3 System Development Life Cycle
  • SA-8 Security and Privacy Engineering Principles

ISO 27001:2022 · 5 controls

  • 8.25 Secure development life cycle
  • 8.26 Application security requirements
  • 8.28 Secure coding
  • 8.29 Security testing in development and acceptance
  • 8.31 Separation of development, test and production environments

ISO 27002:2022 · 5 controls

  • 8.25 Secure development life cycle
  • 8.26 Application security requirements
  • 8.28 Secure coding
  • 8.29 Security testing in development and acceptance
  • 8.31 Separation of development, test and production environments

NIST SP 800-53 Rev 5 · 5 controls

CMMC 2.0 · 4 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

  • CCM-AIS-01 Application and Interface Security Policy and Procedures
  • CCM-AIS-02 Application Security Baseline Requirements
  • CCM-AIS-04 Secure Application Design and Development
  • CCM-DSP-07 Data Protection by Design and Default

HIPAA Security Rule · 4 controls

NIST SP 800-218 · 4 controls

NIST SP 800-66 Rev 2 · 4 controls

ISO 27701:2019 · 3 controls

  • 6.11 Systems acquisition, development and maintenance
  • 6.11.1 Security requirements of information systems
  • 6.11.2 Security in development and support processes

NIST SP 800-161 Rev 1 · 3 controls

SOC 2 · 3 controls

  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Azure Security Benchmark · 2 controls

  • ASBv3-GS-10 Define and implement DevOps security strategy
  • DS-6 Enforce security of workload throughout DevOps lifecycle

AWS Well-Architected Security Pillar · 1 control

  • SEC11-BP02 Automate testing throughout the development and release lifecycle

C5 (Germany) · 1 control

  • C5-DEV-01 Policies for the development/procurement of information systems

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-5 Systems Development and Quality Assurance Category

NIS2 Directive · 1 control

  • Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

NIST SP 800-171 Rev 3 · 1 control

  • 03.16.01 Security Engineering Principles

NIST SP 800-172 · 1 control

  • 3.13.2e Introduce Unpredictability into System Operations

PCI 3DS Core Security Standard · 1 control

  • P1-3.1.1 P1-3.1.1 Secure development lifecycle policy and procedures

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 6: Secure Systems and Software

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 6.2.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 69 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls